systemd-coredump SUID race condition

Summaryinfo

A vulnerability was found in systemd-coredump. It has been rated as critical. This issue affects some unknown processing of the component SUID Handler. Performing a manipulation results in race condition. This vulnerability is identified as CVE-2025-4598. The attack is only possible with local access. Additionally, an exploit exists. You should change the configuration settings.

Detailsinfo

A vulnerability, which was classified as problematic, was found in systemd-coredump (Operating System Utility Software) (version unknown). This affects an unknown function of the component SUID Handler. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on availability. The summary by CVE is:

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

It is possible to read the advisory at openwall.com. This vulnerability is uniquely identified as CVE-2025-4598 since 05/12/2025. The exploitability is told to be difficult. Attacking locally is a requirement. Technical details are unknown but a public exploit is available.

The exploit is shared for download at openwall.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 237502 (Debian dsa-5931 : libnss-myhostname - security update), which helps to determine the existence of the flaw in a target environment.

It is possible to mitigate the problem by applying the configuration setting .

The vulnerability is also documented in the databases at Tenable (237502), EUVD (EUVD-2025-16486) and CERT Bund (WID-SEC-2025-1204). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Siemens SIMATIC S7
• SUSE openSUSE
• Open Source systemd
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System Utility Software

Name

• systemd-coredump

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion